hsflowd does not work on Debian 11

[mehrdade]

I compiled with "make deb" then "dpkg -i hsflowd_2.0.36-2_amd64.deb" and the service is running but it does not work. nothing is being sent to 6343 UDP( checked via "tcpdump -n -i lo port 6343")

cat /etc/hsflowd.conf sflow { collector { ip = 127.0.0.1 UDPPort=6343 } sampling=100 sampling.10G=100 pcap { speed = 1- } tcp {} }

cat /etc/hsflowd.auto rev_start=1 hostname=xxxxxxxxxx sampling=100 header=128 datagram=1400 polling=30 sampling.10G=100 agentIP=xxxxxxxxxxx agent=ens1f0 ds_index=1 collector=127.0.0.1 6343 rev_end=1

[sflow]

sFlow is over UDP, not TCP.

Looks like you need make deb FEATURES="PCAP TCP" to satisfy your hsflowd.conf config. And you might need to apt install libpcap-dev first.

[mehrdade]

libpcap-dev has already been installed, and when UDP or TCP is not Specified in tcpdump command line it captures both modes. anyway, this time I executed "tcpdump -n -i lo port 6343 and udp" but nothing changes

I install hsflowd (exactly the same step) on ubuntu and it works but on Debian 11 hsflowd service is up and running now but it has no functionality.

I Compiled with "make deb " and "make deb FEATURES="PCAP TCP" but nothing changes

[sflow]

OK. I'll try to reproduce what you are seeing...

[sflow]

It's working for me. Here is what I tried: (1) downloaded Debian 11 and built a VM (with web-server and ssh-server checked) (2) apt install build-essential (3) apt install git libpcap-dev (4) make deb (5) dpkg -i hsflowd_2.0.36-2_amd64.deb (6) hsflowd -ddd

In another window "tcpdump -i lo udp port 6343" sees a packet every 30 seconds, as expected. I tried it with your config file, and via systemd. All combinations worked.

I suggest you run "sudo systemctl stop hsflowd" to stop the service and then run "sudo hsflowd -ddd" to see the debugging output. Maybe there is a clue in there as to what is happening?

Another option would be to run sflowtool instead of tcpdump, just in case there is something awry with the tcpdump mechanism on your system.